81d4bdef204c19c64c868282e7a1aa40_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target

81d4bdef204c19c64c868282e7a1aa40_NEIKI
Size

4.8MB
MD5

81d4bdef204c19c64c868282e7a1aa40
SHA1

9180824a1fde2419b11e6541aa7212eb6668c53a
SHA256

d6d2c16749eeac9a36daca1115903d6fd8885c14bb3e6169016bd309583a20bb
SHA512

2d253ea329ac074c09dbe7fae4fb2f759286035d337082bcaee17c8ced84f99e6d8c6aad22aeabc065d52e5d5f94a85b74b163649c10e797bbcb4ab0352c4a2b
SSDEEP

98304:nlqeR6+day1a0xLvgo+rbTf2ZTS8hl9Ei3kQtUWJA00Xe:nlqGaKyz8TJEmtUOT0u

Score

1^/10

Malware Config

Signatures

Files

81d4bdef204c19c64c868282e7a1aa40_NEIKI
.exe windows:6 windows x86 arch:x86

486e5e63457ad4f20d12a2dc294ae4f9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

29:c1:5b:3f:aa:cd:52:6a:4e:67:bd:3c:4e:7e:3f:f2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/07/2012, 00:00

Not After

20/09/2015, 23:59

Subject

CN=Autodesk\, Inc,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Design Solutions Group,O=Autodesk\, Inc,L=San Rafael,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:70:46:c9:43:b1:09:2f:c1:d5:07:f9:92:77:89:39:33:c8:b9:d4
Signer

Actual PE Digest

2b:70:46:c9:43:b1:09:2f:c1:d5:07:f9:92:77:89:39:33:c8:b9:d4

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\projects\PLI\ESD\current\src\bin\Release\AdDLMgrSFX.pdb

Imports

shlwapi

StrFormatByteSizeW
PathRemoveBackslashW
PathRemoveFileSpecW
PathFileExistsW
PathCompactPathW
StrCmpIW

kernel32

GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadLibraryW
SetLastError
GetVersion
VerSetConditionMask
VerifyVersionInfoW
DeleteFileW
lstrlenA
FormatMessageW
GetThreadLocale
LocalFree
CloseHandle
CreateMutexW
MulDiv
CreateFileW
CreateEventA
HeapAlloc
GetProcessHeap
HeapFree
SetEvent
GetCommandLineW
Sleep
InitializeCriticalSection
GetPrivateProfileStringW
GetTickCount
GetSystemTimeAsFileTime
WaitForSingleObject
CreateEventW
GetFullPathNameW
FindFirstFileW
CreateDirectoryW
SetFileTime
CopyFileW
GetFileAttributesW
FindClose
CreateHardLinkW
QueryDosDeviceW
GetFileAttributesExW
SetFileAttributesW
ResumeThread
SetWaitableTimer
ResetEvent
WaitForMultipleObjects
OpenEventA
FormatMessageA
GetModuleHandleA
DeviceIoControl
RemoveDirectoryW
GetDiskFreeSpaceExW
FindNextFileW
LoadLibraryExW
SetFilePointer
SetStdHandle
GetConsoleCP
FlushFileBuffers
GetTimeZoneInformation
OutputDebugStringW
ReadConsoleW
GetConsoleMode
SetFilePointerEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
HeapReAlloc
WriteFile
GetOEMCP
GetACP
IsValidCodePage
HeapSize
AreFileApisANSI
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetTimeFormatW
GetDateFormatW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
GetCPInfo
SetEndOfFile
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
ReadFile
IsDebuggerPresent
EncodePointer
GetStringTypeW
WideCharToMultiByte
DecodePointer
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
InterlockedCompareExchange
MultiByteToWideChar
GetLastError
RaiseException
ExitThread
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
CompareStringW
GetModuleHandleW
GetProcAddress
lstrcmpiW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
LoadResource
LockResource
SizeofResource
FindResourceW
FlushInstructionCache
GetCurrentProcess
lstrlenW
InterlockedIncrement
InterlockedDecrement
CreateWaitableTimerA
SystemTimeToFileTime
CreateThread
SetEnvironmentVariableA

user32

IsWindowVisible
DeleteMenu
DialogBoxParamW
GetDoubleClickTime
UnregisterClassW
SetMenuDefaultItem
TrackPopupMenu
LoadMenuW
CharNextW
LoadStringW
GetDlgCtrlID
GetSubMenu
MonitorFromPoint
GetScrollPos
SendMessageW
GetParent
IsWindowEnabled
GetWindowDC
ReleaseDC
GetWindowRect
ScreenToClient
InflateRect
InvalidateRect
DefWindowProcW
CallWindowProcW
GetWindowLongW
SetWindowLongW
BeginPaint
GetClientRect
EndPaint
LoadCursorW
IsRectEmpty
PtInRect
KillTimer
SetTimer
SetCapture
UpdateWindow
ScrollWindowEx
SetCursor
SetRectEmpty
SetRect
PostMessageW
SetScrollPos
GetScrollInfo
SetScrollInfo
IsWindow
SetWindowPos
DestroyWindow
SetFocus
GetCapture
GetCursorPos
GetClassNameW
SystemParametersInfoW
CreateWindowExW
GetWindowTextLengthW
GetWindowTextW
GetDC
DrawTextW
OffsetRect
EndDialog
GetDlgItem
ShowWindow
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
CreateDialogParamW
SetWindowTextW
RegisterClassExW
GetClassInfoExW
SetForegroundWindow
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetWindow
SetClassLongW
GetClassLongW
SetLayeredWindowAttributes
ClientToScreen
GetKeyState
IsDialogMessageW
LoadIconW
GetDesktopWindow
MessageBoxW
DestroyMenu
RegisterWindowMessageW
EnableWindow
MsgWaitForMultipleObjects
ReleaseCapture
PostQuitMessage
SetParent
ShowScrollBar

gdi32

CreateSolidBrush
DeleteDC
ExtTextOutW
SetBkMode
SetTextColor
SetBkColor
DeleteObject
GetStockObject
GetObjectW
CreateFontIndirectW
SelectObject
GetDeviceCaps
SetViewportOrgEx
CreateCompatibleBitmap
BitBlt
CreateCompatibleDC

advapi32

RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegCloseKey

shell32

ShellExecuteW
SHCreateDirectoryExW
SHGetPathFromIDListW
CommandLineToArgvW
Shell_NotifyIconW
SHBrowseForFolderW

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CreateStreamOnHGlobal

oleaut32

VarUI4FromStr

gdiplus

GdiplusShutdown
GdiplusStartup
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipDrawImageRectRect
GdipDrawArcI
GdipDrawLineI
GdipCreateFromHWND
GdipSetStringFormatTrimming
GdipGetStringFormatFlags
GdipCloneStringFormat
GdipCreateLineBrushI
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetFontSize
GdipGetFamily
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipDrawString
GdipSetStringFormatFlags
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImageWidth
GdipDrawImageRectI
GdipMeasureString
GdipSetTextRenderingHint
GdipAddPathArcI
GdipAddPathLineI
GdipSetStringFormatHotkeyPrefix
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCreateBitmapFromGraphics
GdipCloneImage
GdipDrawImageRect
GdipFillPath
GdipFillRectangle
GdipDrawPath
GdipSetSmoothingMode
GdipGetImageGraphicsContext
GdipAddPathArc
GdipAddPathLine
GdipResetPath
GdipDeletePath
GdipCreatePath
GdipDisposeImage
GdipCreateSolidFill
GdipCloneBrush
GdipDeleteBrush
GdipAlloc
GdipFree
GdipDrawRectangle
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipCreatePen1
GdipGetImageHeight

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

comctl32

InitCommonControlsEx
_TrackMouseEvent

Sections

.text
Size: 471KB - Virtual size: 471KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 638KB - Virtual size: 637KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

486e5e63457ad4f20d12a2dc294ae4f9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

29:c1:5b:3f:aa:cd:52:6a:4e:67:bd:3c:4e:7e:3f:f2Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

2b:70:46:c9:43:b1:09:2f:c1:d5:07:f9:92:77:89:39:33:c8:b9:d4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

version

comctl32

Sections

.text Size: 471KB - Virtual size: 471KB

.rdata Size: 90KB - Virtual size: 89KB

.data Size: 17KB - Virtual size: 27KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 638KB - Virtual size: 637KB

.reloc Size: 71KB - Virtual size: 70KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

29:c1:5b:3f:aa:cd:52:6a:4e:67:bd:3c:4e:7e:3f:f2
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

2b:70:46:c9:43:b1:09:2f:c1:d5:07:f9:92:77:89:39:33:c8:b9:d4
Signer

.text
Size: 471KB - Virtual size: 471KB

.rdata
Size: 90KB - Virtual size: 89KB

.data
Size: 17KB - Virtual size: 27KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 638KB - Virtual size: 637KB

.reloc
Size: 71KB - Virtual size: 70KB